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2013 Energy Subsector Outreach 


Background: On 18 April 2013, unknown actors breached a fence at the Pacific Gas and 
Electric Company (PG&E) electrical substation located near Metcalf Road in San Jose, CA. The 
attackers breached the facility fence line, and shot and damage five transformers. A 
simultaneous disruption in the Santa Clara County 911 system and AT&T phone 
communications in the area was subsequently determined to be the result of severed fiber optic 
cables in a nearby manhole, which are believed to have been cut by the substation assailants. 


I. Situation. In response to this and other recent incidents targeting the energy sector, the 
Department of Energy (DOE) and Department of Homeland Security (DHS), in coordination 
with the Federal Bureau of Investigation (FBI), the Federal Energy Regulatory Commission’s 
Office of Energy Infrastructure Security, the Electricity Sector Information Sharing and Analysis 
Center (ES-ISAC) partners, and industry experts, are conducting a series of briefings across the 
country for owners, operators, and local law enforcement. These briefings will provide an 
overview of the evolving threat, as well as an understanding of available tools, resources, and 
best practices designed to enhance information sharing, physical security, and resilience. 


II. Mission. On 4 February and 18 March in New York City and Boston, respectively, 
Protective Security Advisors inform and educate owners, operators, and law enforcement 
professionals regarding electric substation security to enhance physical security, resilience, and 
information sharing. 


Be prepared to brief public and private partners on vulnerability assessment tools available to 
owners and operators. 


II. Execution. 
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(b) (7)(E), (b) (7)(F) 


IV. Administration and Logistics. 


A. Presentations and Leave Behind Materials. This FOI along with all attachments and 
leave behind materials can be found on the FOB SharePoint outreach page under the “Electrical 
Substation Outreach” folder (b) (7)(E), (b) (7)(F) 


1. PSA Security Briefing slide presentation. 

2. Leave behind materials and Resource Page. 
a. “If You See Something, Say Something™” 
b. Fact Sheet: Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) 
c. Fact Sheet: Suspicious Activity Reporting 


d. Fact Sheet: Office for Bombing Prevention Training and course schedule 
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e. Fact Sheet: Office for Bombing Prevention TRIPwire Community Gateway 
f. Fact Sheet: Office for Bombing Prevention MJIEDSOPD Resource Page 


B. Information Classification and Release. 


1. All information within this outreach is unclassified. 


2. PSAs are not authorized to discuss this outreach with any media; PSAs should 
forward all media requests to the DHS Office of Public Affairs, reachable at 202-282-8010. 


V. Collaboration and Communication. 
A. Communication Plan. 
1. PSCD/FOB Operations Coordinator for this outreach activity is ® (©) (9 
2. PSCD Operations will serve as the single point for PSA Program coordination and 
de-confliction. All RFIs/RFAs and email communication associated with this initiative will be 
routed through (b) (6), (b) (7)(E) 
B. Collaborative Relationships. DOE is the lead agency for the Substation Outreach. PSAs 
should expect contact from their local field office, but should initiate contact if none has 


occurred by 10 January. 


C. Point of contact for this Field Operating Instruction is Program Analyst (b) (6) 


Warning Order 
Energy Substation Outreach 
December 2013—March 2014 


Background: On 18 April 2013, unknown individuals breached an electrical substation IVO 
Metcalf, CA and damaged five generators using small arms and cut fiber optic cable. In 
response, DHS, DOE, FBI, FERC, and ES-ISAC have partnered to conduct information and best 
practices sharing regarding substation security. 


Mission: Protective Security Advisors will inform and educate owners, operators, and local law 
enforcement professionals regarding electric substation security to enhance physical security, 
resilience, and information sharing. 


HQ PSAs will provide a brief (5-10 minutes) that addresses ECIP/IST Vulnerability 
Assessments, training resources available through OBP and SOPD, and IP information sharing 
programs. 


All briefs for the outreach can be found here: 
(b) (7)(E) 


Field PSAs will invite local law enforcement professionals and coordinate for their attendance. 
Field PSAs will also participate in a panel discussion led by SOPD that will include 
representatives from DOE, FBI, and the private sector. 


Initial Coordinating Instructions as follows: 


a. Chicago, IL. Exelon will host the outreach on 14 January at the Palmer House Hilton located 
at 17 E. Monroe, Chicago, IL 60603, in the Red Lacquer Room. Point of contact (b) (6) 


Registration link: (b) (7)(E) 


b. Denver, CO. Xcel Energy will host the outreach on 16 January at 1800 Larimer, Denver CO 


80202 on the second floor in conference room E. Point of contact is (b) (6) 
Registration link: (b) (7)(E) 

c. Tampa Bay, FL. Tampa Electric Co. will host the outreach on 21 January in The Vault located 
at 611 N. Franklin St. Tampa, FL 33602. Point of contact is (b) (6) 

Registration link: (b) (7)(E) 


d. Houston, TX. CenterPoint Energy will host the outreach on 23 January in the CenterPoint 
Auditorium located at 1111 Louisiana, Houston, TX 77002 on the first floor. Point of contact is 
(b) (6) 
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Registration link: (b) (6) 


e. San Jose, CA. PG&E will host the outreach on 11 February at San Jose State University in the 
Barrett Ballroom located at One Washington Square, San Jose, CA 95192. Point of contact is 
(b) (6) 


Register at (b) (6) 


f. Albuquerque, NM. PNM will host the outreach on 12 February at the Hyatt Regency 
Albuquerque located at 330 Tijeras NW, Albuquerque, NM 87102. Points of (b) (6) 


Register at (b) (7)(E) 


g. Seattle, WA. Puget Sound Energy will host the outreach on 13 February in the Puget Sound 
Energy Auditorium located at 355 110th Ave NE, Bellvue, WA 98004. Point of contact is(b) (6) 


Register at (b) (7)(E) 

h. Boston, MA. National Grid will host the outreach on 18 March at Gillette Stadium, | Patriot 
Place, Foxborough, MA, 02035. Point of contact is (b) (6) 

Register at (b) (7)(E) 


i. New York City, NY. Consolidated Edison will host the outreach on 21 March in ConEd’s 
auditorium at 4 Irving Place, New York, NY 10003. Point of contact is (b) (6) 


Register at (b) (7)(E) 


From: (b) (6) 


To: 

Cc: 

‘Subject: FW: FBI investigating new fiber cable attack in California 
Date: Wednesday, March 30, 2022 12:22:46 PM 
Attachments: En tre I n NYC 9Jan14. 


SubstationFollowOnECIP WarnO 18Mar14.docx 
EneraySubstationOutreach WarnO 11Feb14.docx 


(b) (6) not sure if you want to send to (b) (6) . but the attached documents and below email traffic 
are the only materials related to Metcalf we could locate. 


(b) (6) thanks for sending this along for consideration. 
(b) (6) 


(b) (6) 
Chief, Assessments Section 
Resilience Services Branch (RSB) 
Cybersecurity and Infrastructure Security Agency (CISA) 


(b) (6) 
From: (b) (6) 
Sent: Wednesday, March 30, 2022 12:19 PM 
To: (b) (6) 


Subject: FW: FBI investigating new fiber cable attack in California 
(b) (6) 


Here is some email traffic and documents from Metcalf. We did an IST 02/02/2018 and a BZPP on 
07/13/2005. All the other email traffic is spreadsheets on substations, no otherpost-products | can 
find. 


(b) (6) 
Security Specialist 
Cybersecurity and Infrastructure Security Agency 
Cell: (b) (6) 


From: (b) (6) 

Sent: Monday, July 20, 2015 12:46 PM 

To: IAA Program Training Analysts <IAAPTAnalysts@cisa.dhs.gov> 
Ce: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


FOBA, 


I gathered the following excerpts from the FOIs that we used to communicate and task the 


outreach to the PSAs; the first two paragraphs come from the first phase of the outreach where 
we visited 10 cities and presented information to as many facility/sector representatives as 
possible, and the second two come from the follow-on outreach where we offered ECIP visits 
to those responsible for critical substations: 


Background: On 18 April 2013, unknown actors breached a fence at the Pacific Gas and 
Electric Company (PG&E) electrical substation located near Metcalf Road in San Jose, CA. 
The attackers breached the facility fence line, and shot and damage five transformers. A 
simultaneous disruption in the Santa Clara County 911 system and AT&T phone 
communications in the area was subsequently determined to be the result of severed fiber optic 
cables in a nearby manhole, which are believed to have been cut by the substation assailants. 


(b) (7)(E) 


Follow On Actions: Following completion of the Electric Substation Outreach conducted 
from December 2013 to March 2014 in response to the coordinated attack on a substation in 
Metcalf, California, the Field Operations Branch has received tasking to contact the owners 
and operators of the 30 most critical electric substations across the country and offer to 
conduct an (b) (7)(E) 


The Metcalf incident and the substation outreach have raised concerns among the community 
of interest within the electricity subsector regarding the security of substations. Offering ECIP 
visits to the 30 most critical substations demonstrates the federal government’s commitment to 
reducing the vulnerability of this infrastructure. 


I’ve attached the documents for your reference, also. Please let me know if you need anything 
else or have any questions—happy to assist. 


Respectfully, 


(b) (6) 
Contingency Operations Analyst 
Field Operations Branch 
Protective Security Coordination Division 
US. Department of Homeland Security 


From: (b) (6) 

Sent: Monday, July 20, 2015 12:35 PM 
To: FOBAnalysts 

Cc: (b) (6) 

Subject: FW: FBI investigating new fiber cable attack in California 


Importance: High 
FOA, 


Need a couple sentences on this today. Can you please work up a summary of the substation 
outreach, the final analytical report, and a few assessment statistics? Very quick write-up, all from 
existing material. (b) (6) , please pitch in as necessary. 


Thanks! 


(b) (6) 
DHS Office of Infrastructure Protection 
Protective Security Coordination Division 


(b) (6) 


Ane a tree, please don't print this e-mail unless you must. 


From: (b) (6) 

Sent: Monday, July 20, 2015 11:52 AM 

To: = (b) (6) 

Ce: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


Thanks.....can you have somebody draft something up to address the completion of the assessments 
at distribution/transmission substations and the report......and who we continue to work with. 


From: (b) (6) 

Sent: Monday, July 20, 2015 11:06 AM 

To: (b) (6) 

Cc: (b) (6) 

Subject: Re: FBI investigating new fiber cable attack in California 


We can speak to what we're doing in the sector in partnership with the private sector as a result of 
Metcalf and highlight our analytical product and assessment work. We could take the lead with the 
LE agencies (FBI/HSI) providing the status of investigations. 


From: — (b) (6) 

Sent: Monday, July 20, 2015 10:52 AM 

To: — (b) (6) 

Ce: (b) (6) 

Subject: FW: FBI investigating new fiber cable attack in California 


Thoughts on how to respond. Basically our work has been related to monitoring the situation and 
coordinating with the local authorities for situational awareness. 


From: (b) (6) 
Sent: Monday, July 20, 2015 10:44 AM 
To: (b) (6) CS&C Legislative Affairs; 


(b) (6) 
Ce: (b) (6) 
Subject: RE: FBI investigating new fiber cable attack in California 


Adding (b)(6) to see if he has any insight and can speak to his work with other agencies. Rep 
Eshoo is asking for DHS to go up as interagency (FBI, FCC) with DHS as lead. 


BLUF: 

Congresswoman Eshoo (D-CA-18"™) requests a Member-meeting with DHS, FBI and FCC to learn 
more about the cable cut that recently happened in Livermore, California which disrupted service to 
Sacramento. 


Rep. Eshoo is concerned that there is a coordinated national security effort with all the pattern of 
cable cutting and wants to know what we are doing about it. This is a proposed member level 
meeting with the silicon valley congressional delegation to get a handle of how we the interagency 
are keeping on top of things like this. 


Additionally, she was similarly concerned about the Metcalfe incident. 


Link to article Rep Eshoo staffer referenced in request: 


http://www.reuters.com/article/2015/06/30/us-califo 


From: (b) (6) 

Sent: Monday, July 20, 2015 10:42 AM 

To: (b) (6) CS&C Legislative 
Affairs 

Cc: (b) (6) 


Subject: RE: FBI investigating new fiber cable attack in California 
(b) (5), (b) (6) 


From: (b) (6) 

Sent: Monday, July 20, 2015 10:32 AM 

To: (b) (6) ; CS&C Legislative Affairs 
Cc: (b) (6) 


Subject: Re: FBI investigating new fiber cable attack in California 


Do we need a discussion first abt whether we're going up just DHS or with interagency? 


From: (b) (6) 

Sent: Monday, July 20, 2015 10:29 AM 

To: (b) (6) CS&C Legislative Affairs 
Ce: (b) (6) 


Subject: RE: FBI investigating new fiber cable attack in California 


th 


A/S Durkovich is available July 24 between 8-9am. Please let me know if DAS Touhill a (b) (6) 
schedule is open for this date and time so we can lock it on with the staffer. 


From:  (b) (6) 

Sent: Friday, July 17, 2015 2:15 PM 

To: (b) (6) CS&C Legislative Affairs 
Ce: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 

Also looping in (b) (6) , OLA for IP. 

From: (b) (6) 

Sent: Friday, July 17, 2015 2:14 PM 

To: (b) (6) CS&C Legislative Affairs 
Ce: (b) (6) 


Subject: RE: FBI investigating new fiber cable attack in California 


Looping in (b) (6) from IP. Per (b)(6) guidance, he’s checking with his folks to see if 
they’re going to take lead like last time. 


If not, then we may press forward with the DAS. 


From: (b) (6) 

Sent: Friday, July 17, 2015 1:56 PM 

To: (b) (6) CS&C Legislative Affairs 
Ce: (b) (6) 


Subject: RE: FBI investigating new fiber cable attack in California 


Good Afternoon, 


DAS Touhill is available Friday, July 24°" from 8 a.m.-9 a.m. He is not available Wednesday, the 29th 
of July. 


V/r, 


(b) (6) 
Executive Assistant to the Deputy Assistant Secretary Brigadier General Gregory Touhill (USAF ret.) 
SAVVEE Consulting, Inc. 
Supporting Office of Cybersecurity and Communications 


U.S. Department of Homeland Security 
(b) (6) 


From: (b) (6) 


Sent: Friday, July 17, 2015 1:24 PM 

To: (b) (6) ; CS&C Legislative Affairs 
Ce: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


Sure! Whatever works. | was just answering because | saw it hadn’t been answered yet. 


If they do lead, do you want me to still see (b) (6) wants to go in and provide his two cents? 


From: (b) (6) 

Sent: Friday, July 17, 2015 12:59 PM 

To: (b) (6) CS&C Legislative Affairs 

Ce: (b) (6) 

Subject: Re: FBI investigating new fiber cable attack in California 


In the past IP has led this. 

From: (b) (6) 

Sent: Friday, July 17, 2015 12:28 PM 

To: —(b) (6) CS&C Legislative Affairs 

Ce: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


I recommend a Touhill/ (b)(6) tag team on this. 
Looping in (b) (6) to figure out availability. 
Per the earlier email, these are two times that could work for the member: 


Friday, July 24—8-9 
Wednesday, July 29 — 8-9 


From: (b) (6) 

Sent: Friday, July 17, 2015 12:22 PM 

To: CS&C Legislative Affairs 

Ce: (b) (6) 

Subject: FW: FBI investigating new fiber cable attack in California 


| need some help getting this settled. 


Congresswoman Eshoo is a very important member that brings a lot of votes to the table, and also 
represents silicon valley. 


She can be demanding, and difficult if she doesn’t feel she is accommodated. 


Let me know if we are able to adjudicate something through either a referral (I was thinking of 
kicking this off to FBI, or NSC and letting them handle), but want to get them a response asap. 


From: (b) (6) (Eshoo) (b) (6) 

Sent: Friday, July 17, 2015 10:32 AM 

To: — (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


I should mention that we have Member interest from others in the Bay Area. Specifically, Rep. 
Lofgren has indicated that she wants to attend this meeting. | would expect us to invite other 
Members as well. 


From: (b) (6) (Eshoo) 

Sent: Thursday, July 16, 2015 3:58 PM 

To: (b) (6) 

Subject: RE: FBI investigating new fiber cable attack in California 


Here are two possible time frames that would work for my boss: 


Friday, July 24 — 8-9 
Wednesday, July 29 — 8-9 


From: (b) (6) 

Sent: Thursday, July 16, 2015 3:38 PM 

To: (b) (6) (Eshoo) 

Subject: RE: FBI investigating new fiber cable attack in California 


Sorry for missing your call. Running this down. 


From: (b) (6) (Eshoo) (b) (6) 
Sent: Thursday, July 16, 2015 1:36 PM 
To: — (b) (6) 


Subject: RE: FBI investigating new fiber cable attack in California 


(b) (6) my boss is looking to set up a Member-meeting with DHS, FBI and FCC to learn more about 
this. Who would be the best person to work with over at DHS to coordinate? 


From: (0X6) 


To: 
Subject: IP Update for the Week of September 29 
Date: Saturday, October 4, 2014 9:39:00 AM 


IP Colleagues, 


-- Chicago Threat Briefing 

-- Asymmetric Threat Symposium 

-- PCII Awareness Briefings 

-- Incident Management Engagement Plan 


-- Nuts & Bolts 


Chicago Threat Briefing 


(b) (6), (b) (7)(C) and I had the privilege of joining I&A Deputy Under Secretary Jennifer 
Lasley in Chicago on Wednesday to brief Chicago Mayor Rahm Emmanuel on the evolving 
threat environment and threats to critical infrastructure. I focused on the same topics 
<http://nppd-sp.dhs.gov/ip2/home/The_IP_Exchange/Lists/Posts/Post.aspx? 
ID=309%3e> that I covered with Governors Cuomo and Christie: improvised explosive 
devices (IEDs), small scale and active shooter attacks, low-tech kinetic attacks on 
infrastructure like the Metcalf substation, and the weaponization of high-risk chemical 
facilities and the chemicals they store. I also touched upon the risk posed by explosive 
precursors and other commonly available components and the need to raise awareness 
about their use in constru 


From: 


To: 

Subject: that was, we do what we do 
Date: ay, April 17, 2015 6:15:16 PM 
Attachments: @ 


IP Colleagues - 
You've heard me talk about the “week that was” in 2013. 


- April 15: The Boston Marathon bombings and subsequent shootings killed 3 people and 
injured an estimated 264 others. 


- April 16: The Metcalf fiber cut and ballistic attack on a Metcalf Transmission Substation 
located outside of San Jose, California resulting in over $15 million worth of damage. 


- April 17: An ammonium nitrate explosion at the West Fertilizer Company storage and 
distribution facility in West, Texas killed fifteen people, injured more than 160 people, 
and damaged or destroyed more than 150 buildings. 


As you take a moment to remember these events, recall too that April 19 marks the 20th 
anniversary of the bombing of the Alfred P. Murrah Federal Building in Oklahoma City 
that claimed the lives of 168 men, women and children and altered forever the lives of 
countless other survivors and rescue workers. All of these incidents are the reasons we 
dedicate ourselves to public service. We 


Warning Order 
Electric Substation Follow On Action 
18 March—1 April 2014 


Background: Following completion of the Electric Substation Outreach conducted from 
December 2013 to March 2014 in response to the coordinated attack on a substation in Metcalf, 
California, the Field Operations Branch has received tasking to contact the owners and operators 
of the 30 most critical electric substations across the country and offer to conduct an Enhanced 
Critical Infrastructure Protection (ECIP) Visit to assess these sites using the Infrastructure 
Survey Tool (IST). 


Mission: No later than 1 April, Protective Security Advisors will contact the three most critical 
substations within their region, extend the offer to conduct an ECIP visit using the IST, and 
report to headquarters the status of the offer as a way of providing resources to the energy sector 
complementing the current outreach efforts. 


Strategic Intent: The Metcalf incident and the substation outreach have raised concerns among 
the community of interest within the electricity subsector regarding the security of substations. 
Offering ECIP visits to the 30 most critical substations demonstrates the federal government’s 

commitment to reducing the vulnerability of this infrastructure. 


Coordinating Instructions and Tasks: PSAs will identify the three most critical substations 
within their region, initiate contact with the owners and operators, extend the offer to conduct an 
ECIP visit including use of the IST, and track whether owners and operators either accept or 
reject the offer. 


PSAs should submit the results to (b) (7)(E) using the following format: 


PSA and Region: 

Substation Owned and Operated By: 
Substation Location: 

ECIP Offer Accepted: 

Date of Scheduled ECIP: 

Remarks: 


